08b8904
%define distro redhat
7716868
%define polyinstatiate n
1580c87
%define monolithic n
bd3f0ea
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
bd3f0ea
%define BUILD_TARGETED 1
bd3f0ea
%endif
675bbab
%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}
675bbab
%define BUILD_MINIMUM 1
675bbab
%endif
a4ec9b7
%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}
a4ec9b7
%define BUILD_OLPC 0
a4ec9b7
%endif
bd3f0ea
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
3debd0a
%define BUILD_MLS 1
bd3f0ea
%endif
755e2d6
%define POLICYVER 24
755e2d6
%define libsepolver 2.0.41-1
9c90ba7
%define POLICYCOREUTILSVER 2.0.78-1
755e2d6
%define CHECKPOLICYVER 2.0.21-1
1580c87
Summary: SELinux policy configuration
1580c87
Name: selinux-policy
a7a2367
Version: 3.9.1
a7a2367
Release: 1%{?dist}
d83af23
License: GPLv2+
1580c87
Group: System Environment/Base
1580c87
Source: serefpolicy-%{version}.tgz
bc4089c
patch: policy-F14.patch
504da9f
Source1: modules-targeted.conf
504da9f
Source2: booleans-targeted.conf
585f827
Source3: Makefile.devel
504da9f
Source4: setrans-targeted.conf
504da9f
Source5: modules-mls.conf
487de6f
Source6: booleans-mls.conf
504da9f
Source8: setrans-mls.conf
a4ec9b7
Source9: modules-olpc.conf
487de6f
Source10: booleans-olpc.conf
a4ec9b7
Source11: setrans-olpc.conf
a4ec9b7
Source12: securetty_types-olpc
de82d85
Source13: policygentool
ee095f5
Source14: securetty_types-targeted
ee095f5
Source15: securetty_types-mls
675bbab
Source16: modules-minimum.conf
675bbab
Source17: booleans-minimum.conf
675bbab
Source18: setrans-minimum.conf
675bbab
Source19: securetty_types-minimum
80beeee
Source20: customizable_types
faf9cbb
Source21: config.tgz
fc05ac0
Source22: users-mls
fc05ac0
Source23: users-targeted
fc05ac0
Source24: users-olpc
fc05ac0
Source25: users-minimum
3e930b8
0c34c69
Url: http://oss.tresys.com/repos/refpolicy/
ca8bc2d
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
1580c87
BuildArch: noarch
7b146db
BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
dc00fc3
Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk
081b6ac
Requires: checkpolicy >= %{CHECKPOLICYVER} m4 
487de6f
Obsoletes: selinux-policy-devel <= %{version}-%{release}
487de6f
Provides: selinux-policy-devel = %{version}-%{release}
1580c87
1335ee8
%description 
1335ee8
SELinux Base package
1335ee8
1335ee8
%files 
487de6f
%defattr(-,root,root,-)
a85aeff
%{_mandir}/man*/*
a85aeff
# policycoreutils owns these manpage directories, we only own the files within them
a85aeff
%{_mandir}/ru/*/*
585f827
%dir %{_usr}/share/selinux
081b6ac
%dir %{_usr}/share/selinux/devel
081b6ac
%dir %{_usr}/share/selinux/devel/include
62cfafd
%dir %{_usr}/share/selinux/packages
585f827
%dir %{_sysconfdir}/selinux
585f827
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
585f827
%ghost %{_sysconfdir}/sysconfig/selinux
d19b685
%{_usr}/share/selinux/devel/include/*
d19b685
%{_usr}/share/selinux/devel/Makefile
d19b685
%{_usr}/share/selinux/devel/policygentool
d19b685
%{_usr}/share/selinux/devel/example.*
3640444
%{_usr}/share/selinux/devel/policy.*
4125702
4125702
%package doc
4125702
Summary: SELinux policy documentation
4125702
Group: System Environment/Base
4125702
Requires(pre): selinux-policy = %{version}-%{release}
f5a104d
Requires: /usr/bin/xdg-open
4125702
4125702
%description doc
4125702
SELinux policy documentation package
4125702
4125702
%files doc
352dafd
%defattr(-,root,root,-)
4125702
%doc %{_usr}/share/doc/%{name}-%{version}
d2c2609
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
1335ee8
081b6ac
%check
bc4089c
if /usr/sbin/selinuxenabled; then
bc4089c
/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null 
bc4089c
fi
673eaae
487de6f
%define makeCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \
487de6f
cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \
487de6f
cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \
487de6f
cp -f selinux_config/users-%1 ./policy/users \
9987374
de82d85
%define installCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \
01ce3df
make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
ca8bc2d
#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
ca8bc2d
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
487de6f
install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
487de6f
install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
487de6f
install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
487de6f
bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp \
487de6f
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst
3e930b8
%nil
1580c87
1580c87
%define fileList() \
1580c87
%defattr(-,root,root) \
d7e0f9f
%dir %{_usr}/share/selinux/%1 \
9987374
%{_usr}/share/selinux/%1/*.pp.bz2 \
487de6f
%{_usr}/share/selinux/%1/modules.lst \
1580c87
%dir %{_sysconfdir}/selinux/%1 \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
1580c87
%ghost %{_sysconfdir}/selinux/%1/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/modules \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
21dea1c
%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \
97081dc
#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/policy/ \
7c94e8e
%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts \
d2c2609
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
ee095f5
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
5ca2ff9
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
7c94e8e
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
487de6f
%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
487de6f
%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts/files \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
d19b685
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
da08298
%dir %{_sysconfdir}/selinux/%1/contexts/users \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
a80e7ac
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 
1580c87
1580c87
%define saveFileContext() \
bd7e86c
if [ -s /etc/selinux/config ]; then \
487de6f
     . %{_sysconfdir}/selinux/config; \
487de6f
     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
487de6f
     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
487de6f
        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
487de6f
     fi \
bd7e86c
fi
1580c87
a4ec9b7
%define loadpolicy() \
02d888c
( cd /usr/share/selinux/%1; \
0e31a0e
semodule -b base.pp.bz2 -i %2 -s %1; \
bb36d75
); \
1580c87
1580c87
%define relabel() \
1580c87
. %{_sysconfdir}/selinux/config; \
1580c87
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
2528fa0
selinuxenabled; \
e080bbd
if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
487de6f
     fixfiles -C ${FILE_CONTEXT}.pre restore; \
487de6f
     restorecon -R /root /var/log /var/run /var/lib 2> /dev/null; \
487de6f
     rm -f ${FILE_CONTEXT}.pre; \
1580c87
fi; 
1580c87
1580c87
%description
1580c87
SELinux Reference Policy - modular.
55acbfd
Based off of reference policy: Checked out revision  2.20091117
1580c87
d83af23
%build
d83af23
3e930b8
%prep 
d83af23
%setup -n serefpolicy-%{version} -q
3c584c7
%patch -p1
add9573
add9573
%install
487de6f
mkdir selinux_config
487de6f
for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} %{SOURCE25};do
487de6f
 cp $i selinux_config
487de6f
done
487de6f
tar zxvf selinux_config/config.tgz
e568731
# Build targeted policy
ca8bc2d
%{__rm} -fR %{buildroot}
28021c8
mkdir -p %{buildroot}%{_mandir}
7330e86
cp -R  man/* %{buildroot}%{_mandir}
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/selinux
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/config
ca8bc2d
touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
1335ee8
b4cab5a
# Always create policy module package directories
2fbeb78
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/
b4cab5a
d19b685
# Install devel
d19b685
make clean
bd3f0ea
%if %{BUILD_TARGETED}
129ba16
# Build targeted policy
129ba16
# Commented out because only targeted ref policy currently builds
487de6f
%makeCmds targeted mcs n y allow
db0dafa
%installCmds targeted mcs n y allow
bd3f0ea
%endif
3e930b8
675bbab
%if %{BUILD_MINIMUM}
675bbab
# Build minimum policy
675bbab
# Commented out because only minimum ref policy currently builds
487de6f
%makeCmds minimum mcs n y allow
675bbab
%installCmds minimum mcs n y allow
675bbab
%endif
675bbab
bd3f0ea
%if %{BUILD_MLS}
129ba16
# Build mls policy
487de6f
%makeCmds mls mls n y deny
9185bf2
%installCmds mls mls n y deny
a4ec9b7
%endif
a4ec9b7
a4ec9b7
%if %{BUILD_OLPC}
675bbab
# Build olpc policy
675bbab
# Commented out because only olpc ref policy currently builds
487de6f
%makeCmds olpc mcs n y allow
9185bf2
%installCmds olpc mcs n y allow
bd3f0ea
%endif
129ba16
db0dafa
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
ce7f30a
mkdir %{buildroot}%{_usr}/share/selinux/devel/
62cfafd
mkdir %{buildroot}%{_usr}/share/selinux/packages/
ce7f30a
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
487de6f
install -m 755 selinux_config/policygentool %{buildroot}%{_usr}/share/selinux/devel/
487de6f
install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
ce7f30a
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
3640444
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/
f1a8278
echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30a
chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp
487de6f
rm -rf selinux_config
1580c87
%clean
ca8bc2d
%{__rm} -fR %{buildroot}
1580c87
9c64bb6
%post
af60908
if [ ! -s /etc/selinux/config ]; then
487de6f
#
487de6f
#     New install so we will default to targeted policy
487de6f
#
487de6f
echo "
af60908
# This file controls the state of SELinux on the system.
af60908
# SELINUX= can take one of these three values:
487de6f
#     enforcing - SELinux security policy is enforced.
487de6f
#     permissive - SELinux prints warnings instead of enforcing.
487de6f
#     disabled - No SELinux policy is loaded.
af60908
SELINUX=enforcing
af60908
# SELINUXTYPE= can take one of these two values:
487de6f
#     targeted - Targeted processes are protected,
487de6f
#     mls - Multi Level Security protection.
af60908
SELINUXTYPE=targeted 
af60908
af60908
" > /etc/selinux/config
af60908
487de6f
     ln -sf ../selinux/config /etc/sysconfig/selinux 
487de6f
     restorecon /etc/selinux/config 2> /dev/null || :
af60908
else
487de6f
     . /etc/selinux/config
487de6f
     # if first time update booleans.local needs to be copied to sandbox
487de6f
     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/
487de6f
     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers
af60908
fi
081b6ac
exit 0
9c64bb6
5ff36d6
%postun
bbaa1f2
if [ $1 = 0 ]; then
487de6f
     setenforce 0 2> /dev/null
487de6f
     if [ ! -s /etc/selinux/config ]; then
487de6f
          echo "SELINUX=disabled" > /etc/selinux/config
487de6f
     else
487de6f
          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
487de6f
     fi
5ff36d6
fi
a4ec9b7
exit 0
5ff36d6
bd3f0ea
%if %{BUILD_TARGETED}
bd3f0ea
%package targeted
bd3f0ea
Summary: SELinux targeted base policy
487de6f
Provides: selinux-policy-base = %{version}-%{release}
bd3f0ea
Group: System Environment/Base
d83af23
Obsoletes: selinux-policy-targeted-sources < 2
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
b4cab5a
Conflicts:  audispd-plugins <= 1.7.7-1
487de6f
Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
bc4089c
Obsoletes: cachefilesd-selinux <= 0.10-1
6b7b0c1
Conflicts:  seedit
bd3f0ea
bd3f0ea
%description targeted
bd3f0ea
SELinux Reference policy targeted base module.
bd3f0ea
bd3f0ea
%pre targeted
bd3f0ea
%saveFileContext targeted
bd3f0ea
9c64bb6
%post targeted
487de6f
packages=`cat /usr/share/selinux/targeted/modules.lst`
e080bbd
if [ $1 -eq 1 ]; then
e080bbd
   %loadpolicy targeted $packages
755e2d6
   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
e080bbd
else
922cd61
   semodule -n -s targeted -r pyzor -r razor -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null
e080bbd
   %loadpolicy targeted $packages
e080bbd
   %relabel targeted
e080bbd
fi
e080bbd
exit 0
d83af23
5baf53a
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
4b1d56d
. /etc/selinux/config
4b1d56d
[ "${SELINUXTYPE}" != "targeted" ] && exit 0
af67779
setsebool -P use_nfs_home_dirs=1
df62201
semanage user -l | grep -s unconfined_u > /dev/null
a6e1280
if [ $? -eq 0 ]; then
df62201
   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
else
df62201
   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
fi
99d3676
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
4b1d56d
[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
99d3676
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
e080bbd
[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
1ffa684
restorecon -R /root /etc/selinux/targeted 2> /dev/null
5baf53a
semodule -r qmail 2> /dev/null
a4ec9b7
exit 0
af60908
bd3f0ea
%files targeted
487de6f
%defattr(-,root,root,-)
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
4d59c29
%fileList targeted
a4ec9b7
%endif
a4ec9b7
675bbab
%if %{BUILD_MINIMUM}
675bbab
%package minimum
675bbab
Summary: SELinux minimum base policy
487de6f
Provides: selinux-policy-base = %{version}-%{release}
675bbab
Group: System Environment/Base
23e7082
Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}
675bbab
Requires(pre): coreutils
675bbab
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
675bbab
675bbab
%description minimum
675bbab
SELinux Reference policy minimum base module.
675bbab
675bbab
%pre minimum
675bbab
%saveFileContext minimum
675bbab
675bbab
%post minimum
487de6f
packages="execmem.pp.bz2 unconfined.pp.bz2 unconfineduser.pp.bz2"
32594a1
%loadpolicy minimum $packages
0e31a0e
if [ $1 -eq 1 ]; then
675bbab
semanage -S minimum -i - << __eof
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 root
675bbab
__eof
755e2d6
restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
675bbab
else
675bbab
%relabel minimum
675bbab
fi
675bbab
exit 0
675bbab
675bbab
%files minimum
487de6f
%defattr(-,root,root,-)
675bbab
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
675bbab
%fileList minimum
675bbab
%endif
675bbab
a4ec9b7
%if %{BUILD_OLPC}
a4ec9b7
%package olpc 
a4ec9b7
Summary: SELinux olpc base policy
a4ec9b7
Group: System Environment/Base
487de6f
Provides: selinux-policy-base = %{version}-%{release}
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
a4ec9b7
a4ec9b7
%description olpc 
a4ec9b7
SELinux Reference policy olpc base module.
a4ec9b7
a4ec9b7
%pre olpc 
a4ec9b7
%saveFileContext olpc
a4ec9b7
a4ec9b7
%post olpc 
487de6f
packages=`cat /usr/share/selinux/olpc/modules.lst`
c32d79e
%loadpolicy olpc $packages
8fd9df6
a6e1280
if [ $1 -ne 1 ]; then
a4ec9b7
%relabel olpc
24ccb8b
fi
a4ec9b7
exit 0
a4ec9b7
a4ec9b7
%files olpc
487de6f
%defattr(-,root,root,-)
a4ec9b7
%fileList olpc
bd3f0ea
bd3f0ea
%endif
bd3f0ea
bd3f0ea
%if %{BUILD_MLS}
504da9f
%package mls 
504da9f
Summary: SELinux mls base policy
1580c87
Group: System Environment/Base
487de6f
Provides: selinux-policy-base = %{version}-%{release}
d83af23
Obsoletes: selinux-policy-mls-sources < 2
c77aca5
Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
1580c87
504da9f
%description mls 
504da9f
SELinux Reference policy mls base module.
1580c87
504da9f
%pre mls 
504da9f
%saveFileContext mls
1580c87
504da9f
%post mls 
922cd61
semodule -n -s mls -r pyzor -r razor -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null
487de6f
packages=`cat /usr/share/selinux/mls/modules.lst`
c32d79e
%loadpolicy mls $packages
8fd9df6
487de6f
if [ $1 -eq 1 ]; then
487de6f
   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
487de6f
else
504da9f
%relabel mls
24ccb8b
fi
a4ec9b7
exit 0
1580c87
504da9f
%files mls
487de6f
%defattr(-,root,root,-)
57ae10c
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
504da9f
%fileList mls
3e930b8
bd3f0ea
%endif
bd3f0ea
56187c2
%changelog
a7a2367
* Mon Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-1
a7a2367
- Merge with upstream
a7a2367
6578cf7
* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-2
6578cf7
- More access needed for devicekit
6578cf7
- Add dbadm policy
6578cf7
ba77266
* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-1
ba77266
- Merge with upstream
ba77266
370d04e
* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-21
370d04e
- Allow seunshare to fowner
370d04e
cc138e8
* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-20
cc138e8
- Allow cron to look at user_cron_spool links
cc138e8
- Lots of fixes for mozilla_plugin_t
cc138e8
- Add sysv file system
cc138e8
- Turn unconfined domains to permissive to find additional avcs
cc138e8
6326566
* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-19
6326566
- Update policy for mozilla_plugin_t
6326566
eee39f9
* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-18
eee39f9
- Allow clamscan to read proc_t
eee39f9
- Allow mount_t to write to debufs_t dir
eee39f9
- Dontaudit mount_t trying to write to security_t dir
eee39f9
19988ca
* Thu Aug 18 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-17
19988ca
- Allow clamscan_t execmem if clamd_use_jit set
19988ca
- Add policy for firefox plugin-container
19988ca
19988ca
* Wed Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-16
19988ca
- Fix /root/.forward definition
19988ca
3798ee9
* Tue Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-15
3798ee9
- label dead.letter as mail_home_t
3798ee9
3798ee9
* Fri Aug 13 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-14
3798ee9
- Allow login programs to search /cgroups
3798ee9
3798ee9
* Thu Aug 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-13
3798ee9
- Fix cert handling
3798ee9
922cd61
* Tue Aug 10 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-12
922cd61
- Fix devicekit_power bug
922cd61
- Allow policykit_auth_t more access.
922cd61
922cd61
* Thu Aug 5 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-11
922cd61
- Fix nis calls to allow bind to ports 512-1024
922cd61
- Fix smartmon
922cd61
922cd61
* Wed Aug 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-10
922cd61
- Allow pcscd to read sysfs
922cd61
- systemd fixes 
922cd61
- Fix wine_mmap_zero_ignore boolean
922cd61
922cd61
* Tue Aug 3 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-9
922cd61
- Apply Miroslav munin patch
922cd61
- Turn back on allow_execmem and allow_execmod booleans
922cd61
d4bb132
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-8
d4bb132
- Merge in fixes from dgrift repository
d4bb132
7f5d8f3
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
7f5d8f3
- Update boinc policy
7f5d8f3
- Fix sysstat policy to allow sys_admin
7f5d8f3
- Change failsafe_context to unconfined_r:unconfined_t:s0
7f5d8f3
a1ef703
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
a1ef703
- New paths for upstart
a1ef703
8d55a41
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-5
8d55a41
- New permissions for syslog
8d55a41
- New labels for /lib/upstart
8d55a41
8d55a41
* Fri Jul 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-4
8d55a41
- Add mojomojo policy
8d55a41
f3fc105
* Thu Jul 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-3
f3fc105
- Allow systemd to setsockcon on sockets to immitate other services
f3fc105
9f811ef
* Wed Jul 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-2
9f811ef
- Remove debugfs label
9f811ef
d66bec6
* Tue Jul 20 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-1
d66bec6
- Update to latest policy
d66bec6
1df2fc2
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-3
1df2fc2
- Fix eclipse labeling from IBMSupportAssasstant packageing
1df2fc2
3f1005a
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-2
3f1005a
- Make boot with systemd in enforcing mode
3f1005a
0f2ae00
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-1
0f2ae00
- Update to upstream
0f2ae00
9c1bcc2
* Mon Jul 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-3
9c1bcc2
- Add boolean to turn off port forwarding in sshd.
9c1bcc2
be922a1
* Fri Jul 9 2010 Miroslav Grepl <mgrepl@redhat.com> 3.8.6-2
be922a1
- Add support for ebtables
be922a1
- Fixes for rhcs and corosync policy
be922a1
6c42218
* Tue Jun 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-1
6c42218
-Update to upstream
6c42218
fa98e0e
* Mon Jun 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.5-1
fa98e0e
-Update to upstream
fa98e0e
5f371ac
* Thu Jun 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.4-1
5f371ac
-Update to upstream
5f371ac
5f371ac
* Wed Jun 16 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-4
7c727a8
- Add Zarafa policy
7c727a8
f2403c5
* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-3
f2403c5
- Cleanup of aiccu policy
f2403c5
- initial mock policy
f2403c5
f651bb6
* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-2
f651bb6
- Lots of random fixes
f651bb6
b39ccca
* Tue Jun 8 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-1
b39ccca
- Update to upstream
b39ccca
632048c
* Fri Jun 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.2-1
632048c
- Update to upstream
632048c
- Allow prelink script to signal itself
632048c
- Cobbler fixes
632048c
bca242c
* Wed Jun 2 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-5
bca242c
- Add xdm_var_run_t to xserver_stream_connect_xdm
bca242c
- Add cmorrord and mpd policy from Miroslav Grepl
bca242c
bca242c
* Tue Jun 1 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-4
e512844
- Fix sshd creation of krb cc files for users to be user_tmp_t
e512844
4abfc01
* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-3
4abfc01
- Fixes for accountsdialog
4abfc01
- Fixes for boinc
4abfc01
65c6e4c
* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-2
65c6e4c
- Fix label on /var/lib/dokwiki
65c6e4c
- Change permissive domains to enforcing
65c6e4c
- Fix libvirt policy to allow it to run on mls
65c6e4c
bc4089c
* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-1
bc4089c
- Update to upstream
bc4089c
bc4089c
* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-22
bc4089c
- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
bc4089c
- Fix /var/run/abrtd.lock label
bc4089c
bc4089c
* Mon May 24 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-21
bc4089c
- Allow login programs to read krb5_home_t
bc4089c
Resolves: 594833
bc4089c
- Add obsoletes for cachefilesfd-selinux package
bc4089c
Resolves: #575084
bc4089c
bc4089c
* Thu May 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-20
bc4089c
- Allow mount to r/w abrt fifo file
bc4089c
- Allow svirt_t to getattr on hugetlbfs
bc4089c
- Allow abrt to create a directory under /var/spool
bc4089c
bc4089c
* Wed May 19 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-19
bc4089c
- Add labels for /sys
bc4089c
- Allow sshd to getattr on shutdown
bc4089c
- Fixes for munin
bc4089c
- Allow sssd to use the kernel key ring
bc4089c
- Allow tor to send syslog messages
bc4089c
- Allow iptabels to read usr files
bc4089c
- allow policykit to read all domains state
bc4089c
bc4089c
* Thu May 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-17
bc4089c
- Fix path for /var/spool/abrt
bc4089c
- Allow nfs_t as an entrypoint for http_sys_script_t
bc4089c
- Add policy for piranha
bc4089c
- Lots of fixes for sosreport
bc4089c
bc4089c
* Wed May 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-16
bc4089c
- Allow xm_t to read network state and get and set capabilities
bc4089c
- Allow policykit to getattr all processes
bc4089c
- Allow denyhosts to connect to tcp port 9911
bc4089c
- Allow pyranha to use raw ip sockets and ptrace itself
bc4089c
- Allow unconfined_execmem_t and gconfsd mechanism to dbus
bc4089c
- Allow staff to kill ping process
bc4089c
- Add additional MLS rules
bc4089c
bc4089c
* Mon May 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-15
bc4089c
- Allow gdm to edit ~/.gconf dir
bc4089c
Resolves: #590677
bc4089c
- Allow dovecot to create directories in /var/lib/dovecot
bc4089c
Partially resolves 590224
bc4089c
- Allow avahi to dbus chat with NetworkManager
bc4089c
- Fix cobbler labels
bc4089c
- Dontaudit iceauth_t leaks
bc4089c
- fix /var/lib/lxdm file context
bc4089c
- Allow aiccu to use tun tap devices
bc4089c
- Dontaudit shutdown using xserver.log
bc4089c
bc4089c
* Fri May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-14
bc4089c
- Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
bc4089c
- Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
bc4089c
- Add dontaudit interface for bluetooth dbus
bc4089c
- Add chronyd_read_keys, append_keys for initrc_t
bc4089c
- Add log support for ksmtuned
bc4089c
Resolves: #586663
bc4089c
bc4089c
* Thu May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-13
bc4089c
- Allow boinc to send mail
bc4089c
bc4089c
* Wed May 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-12
bc4089c
- Allow initrc_t to remove dhcpc_state_t
bc4089c
- Fix label on sa-update.cron
bc4089c
- Allow dhcpc to restart chrony initrc
bc4089c
- Don't allow sandbox to send signals to its parent processes
bc4089c
- Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
bc4089c
Resolves: #589136
bc4089c
bc4089c
* Mon May 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-11
bc4089c
- Fix location of oddjob_mkhomedir
bc4089c
Resolves: #587385
bc4089c
- fix labeling on /root/.shosts and ~/.shosts
bc4089c
- Allow ipsec_mgmt_t to manage net_conf_t
bc4089c
Resolves: #586760
bc4089c
bc4089c
* Fri Apr 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-10
bc4089c
- Dontaudit sandbox trying to connect to netlink sockets
bc4089c
Resolves: #587609
bc4089c
- Add policy for piranha
bc4089c
bc4089c
* Thu Apr 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-9
bc4089c
- Fixups for xguest policy
bc4089c
- Fixes for running sandbox firefox
bc4089c
bc4089c
* Wed Apr 28 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-8
bc4089c
- Allow ksmtuned to use terminals
bc4089c
Resolves: #586663
bc4089c
- Allow lircd to write to generic usb devices
bc4089c
bc4089c
* Tue Apr 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-7
bc4089c
- Allow sandbox_xserver to connectto unconfined stream
bc4089c
Resolves: #585171
bc4089c
bc4089c
* Mon Apr 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-6
bc4089c
- Allow initrc_t to read slapd_db_t
bc4089c
Resolves: #585476
bc4089c
- Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
bc4089c
Resolves: #585963
bc4089c
bc4089c
* Thu Apr 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-5
bc4089c
- Allow rlogind_t to search /root for .rhosts
bc4089c
Resolves: #582760
bc4089c
- Fix path for cached_var_t
bc4089c
- Fix prelink paths /var/lib/prelink	
bc4089c
- Allow confined users to direct_dri
bc4089c
- Allow mls lvm/cryptosetup to work
bc4089c
bc4089c
* Wed Apr 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-4
bc4089c
- Allow virtd_t to manage firewall/iptables config
bc4089c
Resolves: #573585
bc4089c
bc4089c
* Tue Apr 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-3
bc4089c
- Fix label on /root/.rhosts
bc4089c
Resolves: #582760
bc4089c
- Add labels for Picasa
bc4089c
- Allow openvpn to read home certs
bc4089c
- Allow plymouthd_t to use tty_device_t
bc4089c
- Run ncftool as iptables_t
bc4089c
- Allow mount to unmount unlabeled_t
bc4089c
- Dontaudit hal leaks
bc4089c
bc4089c
* Wed Apr 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-2
bc4089c
- Allow livecd to transition to mount
bc4089c
bc4089c
* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-1
bc4089c
- Update to upstream
bc4089c
- Allow abrt to delete sosreport
bc4089c
Resolves: #579998
bc4089c
- Allow snmp to setuid and gid
bc4089c
Resolves: #582155
bc4089c
- Allow smartd to use generic scsi devices
bc4089c
Resolves: #582145
bc4089c
bc4089c
* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-3
bc4089c
- Allow ipsec_t to create /etc/resolv.conf with the correct label
bc4089c
- Fix reserved port destination
bc4089c
- Allow autofs to transition to showmount
bc4089c
- Stop crashing tuned
bc4089c
bc4089c
* Mon Apr 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-2
bc4089c
- Add telepathysofiasip policy
bc4089c
bc4089c
* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-1
bc4089c
- Update to upstream
bc4089c
- Fix label for  /opt/google/chrome/chrome-sandbox
bc4089c
- Allow modemmanager to dbus with policykit
bc4089c
bc4089c
* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-6
bc4089c
- Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
bc4089c
- Allow accountsd to read shadow file
bc4089c
- Allow apache to send audit messages when using pam
bc4089c
- Allow asterisk to bind and connect to sip tcp ports
bc4089c
- Fixes for dovecot 2.0
bc4089c
- Allow initrc_t to setattr on milter directories
bc4089c
- Add procmail_home_t for .procmailrc file
bc4089c
bc4089c
bc4089c
* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-5
bc4089c
- Fixes for labels during install from livecd
bc4089c
bc4089c
* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-4
bc4089c
- Fix /cgroup file context 
bc4089c
- Fix broken afs use of unlabled_t
bc4089c
- Allow getty to use the console for s390
bc4089c
bc4089c
* Wed Mar 31 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-3
bc4089c
- Fix cgroup handling adding policy for /cgroup
bc4089c
- Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set
bc4089c
bc4089c
* Tue Mar 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-2
bc4089c
- Merge patches from dgrift
bc4089c
bc4089c
* Mon Mar 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-1
bc4089c
- Update upstream
bc4089c
- Allow abrt to write to the /proc under any process
bc4089c
bc4089c
* Fri Mar 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-2
bc4089c
  - Fix ~/.fontconfig label
bc4089c
- Add /root/.cert label
bc4089c
- Allow reading of the fixed_file_disk_t:lnk_file if you can read file
bc4089c
- Allow qemu_exec_t as an entrypoint to svirt_t
bc4089c
bc4089c
* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-1
bc4089c
- Update to upstream
bc4089c
- Allow tmpreaper to delete sandbox sock files
bc4089c
- Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
bc4089c
- Fixes for gitosis
bc4089c
- No transition on livecd to passwd or chfn
bc4089c
- Fixes for denyhosts
bc4089c
bc4089c
* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-4
bc4089c
- Add label for /var/lib/upower
bc4089c
- Allow logrotate to run sssd
bc4089c
- dontaudit readahead on tmpfs blk files
bc4089c
- Allow tmpreaper to setattr on sandbox files
bc4089c
- Allow confined users to execute dos files
bc4089c
- Allow sysadm_t to kill processes running within its clearance
bc4089c
- Add accountsd policy
bc4089c
- Fixes for corosync policy
bc4089c
- Fixes from crontab policy
bc4089c
- Allow svirt to manage svirt_image_t chr files
bc4089c
- Fixes for qdisk policy
bc4089c
- Fixes for sssd policy
bc4089c
- Fixes for newrole policy
bc4089c
bc4089c
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-3
bc4089c
- make libvirt work on an MLS platform
bc4089c
bc4089c
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-2
bc4089c
- Add qpidd policy
bc4089c
a72c31d
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Tue Mar 16 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-5
a72c31d
- Allow boinc to read kernel sysctl
a72c31d
- Fix snmp port definitions
a72c31d
- Allow apache to read anon_inodefs
a72c31d
a72c31d
* Sun Mar 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-4
a72c31d
- Allow shutdown dac_override
a72c31d
a72c31d
* Sat Mar 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-3
a72c31d
- Add device_t as a file system
a72c31d
- Fix sysfs association
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-2
a72c31d
- Dontaudit ipsec_mgmt sys_ptrace
a72c31d
- Allow at to mail its spool files
a72c31d
- Allow nsplugin to search in .pulse directory
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-4
a72c31d
- Allow users to dbus chat with xdm
a72c31d
- Allow users to r/w wireless_device_t
a72c31d
- Dontaudit reading of process states by ipsec_mgmt
a72c31d
a72c31d
* Thu Mar 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-3
a72c31d
- Fix openoffice from unconfined_t
a72c31d
a72c31d
* Wed Mar 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-2
a72c31d
- Add shutdown policy so consolekit can shutdown system
a72c31d
a72c31d
* Tue Mar 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.12-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.11-1
a72c31d
- Update to upstream - These are merges of my patches
a72c31d
- Remove 389 labeling conflicts
a72c31d
- Add MLS fixes found in RHEL6 testing
a72c31d
- Allow pulseaudio to run as a service
a72c31d
- Add label for mssql and allow apache to connect to this database port if boolean set
a72c31d
- Dontaudit searches of debugfs mount point
a72c31d
- Allow policykit_auth to send signals to itself
a72c31d
- Allow modcluster to call getpwnam
a72c31d
- Allow swat to signal winbind
a72c31d
- Allow usbmux to run as a system role
a72c31d
- Allow svirt to create and use devpts
a72c31d
a72c31d
* Mon Mar 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-5
a72c31d
- Add MLS fixes found in RHEL6 testing
a72c31d
- Allow domains to append to rpm_tmp_t
a72c31d
- Add cachefilesfd policy
a72c31d
- Dontaudit leaks when transitioning
a72c31d
a72c31d
* Wed Feb 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-4
a72c31d
- Change allow_execstack and allow_execmem booleans to on
a72c31d
- dontaudit acct using console
a72c31d
- Add label for fping
a72c31d
- Allow tmpreaper to delete sandbox_file_t
a72c31d
- Fix wine dontaudit mmap_zero
a72c31d
- Allow abrt to read var_t symlinks
a72c31d
a72c31d
* Tue Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-3
a72c31d
- Additional policy for rgmanager
a72c31d
a72c31d
* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-2
a72c31d
- Allow sshd to setattr on pseudo terms
a72c31d
a72c31d
* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Feb 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-4
a72c31d
- Allow policykit to send itself signals
a72c31d
a72c31d
* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-3
a72c31d
- Fix duplicate cobbler definition
a72c31d
a72c31d
* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-2
a72c31d
- Fix file context of /var/lib/avahi-autoipd
a72c31d
add9573
* Fri Feb 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-1
add9573
- Merge with upstream
add9573
3c551b8
* Thu Feb 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-11
3c551b8
- Allow sandbox to work with MLS 
3c551b8
43c7f5f
* Tue Feb 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-9
43c7f5f
- Make Chrome work with staff user
43c7f5f
487de6f
* Thu Feb 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-8
487de6f
- Add icecast policy
487de6f
- Cleanup  spec file
487de6f
30c2199
* Wed Feb 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-7
30c2199
- Add mcelog policy
30c2199
a62c640
* Mon Feb 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-6
a62c640
- Lots of fixes found in F12
a62c640
b2f6b06
* Thu Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-5
b2f6b06
- Fix rpm_dontaudit_leaks
b2f6b06
4d67b40
* Wed Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-4
4d67b40
- Add getsched to hald_t
4d67b40
- Add file context for Fedora/Redhat Directory Server
4d67b40
b0f3656
* Mon Jan 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-3
b0f3656
- Allow abrt_helper to getattr on all filesystems
487de6f
- Add label for /opt/real/RealPlayer/plugins/oggfformat\.so     
b0f3656
b65afa2
* Thu Jan 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-2
b65afa2
- Add gstreamer_home_t for ~/.gstreamer
b65afa2
faec5c2
* Mon Jan 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-1
faec5c2
- Update to upstream
faec5c2
3b54668
* Fri Jan 15 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-3
3b54668
- Fix git
3b54668
89ad5ea
* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-2
89ad5ea
- Turn on puppet policy
89ad5ea
- Update to dgrift git policy
89ad5ea
fc05ac0
* Mon Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-1
fc05ac0
- Move users file to selection by spec file.
fc05ac0
- Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t
fc05ac0
352dafd
* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.6-1
352dafd
- Update to upstream
352dafd
6049e24
* Wed Jan 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-8
6049e24
- Remove most of the permissive domains from F12.
6049e24
485ded5
* Tue Jan 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-7
485ded5
- Add cobbler policy from dgrift
485ded5
1e86f3f
* Mon Jan 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-6
1e86f3f
- add usbmon device
1e86f3f
- Add allow rulse for devicekit_disk
1e86f3f
4478a9a
* Wed Dec 30 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-5
4478a9a
- Lots of fixes found in F12, fixes from Tom London
4478a9a
e2f53df
* Wed Dec 23 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-4
e2f53df
- Cleanups from dgrift
e2f53df
550cc5f
* Tue Dec 22 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-3
550cc5f
- Add back xserver_manage_home_fonts
550cc5f
7d40583
* Mon Dec 21 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-2
7d40583
- Dontaudit sandbox trying to read nscd and sssd
7d40583
b467541
* Fri Dec 18 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-1
b467541
- Update to upstream
b467541
b467541
* Thu Dec 17 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-4
6ca563e
- Rename udisks-daemon back to devicekit_disk_t policy
6ca563e
e54cc7c
* Wed Dec 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-3
e54cc7c
- Fixes for abrt calls
e54cc7c
755e2d6
* Fri Dec 11 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-2
755e2d6
- Add tgtd policy
755e2d6
9eef358
* Fri Dec 4 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-1
9eef358
- Update to upstream release
9eef358
f2a1dcd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.3-1
ce8c76d
- Add asterisk policy back in
f2a1dcd
- Update to upstream release 2.20091117
ce8c76d
55acbfd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.1-1
55acbfd
- Update to upstream release 2.20091117
55acbfd
55acbfd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-2
55acbfd
- Fixup nut policy
55acbfd
5e44eb8
* Thu Nov 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-1
5e44eb8
- Update to upstream
5e44eb8
32594a1
* Thu Oct 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-17
32594a1
- Allow vpnc request the kernel to load modules
32594a1
32594a1
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-16
32594a1
- Fix minimum policy installs
32594a1
- Allow udev and rpcbind to request the kernel to load modules
32594a1
32594a1
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-15
aaf52ff
- Add plymouth policy
32594a1
- Allow local_login to sys_admin
aaf52ff
aaf52ff
* Tue Sep 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-13
d976a83
- Allow cupsd_config to read user tmp
d976a83
- Allow snmpd_t to signal itself
d976a83
- Allow sysstat_t to makedir in sysstat_log_t
d976a83
8b10e3a
* Fri Sep 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-12
8b10e3a
- Update rhcs policy
8b10e3a
85582d6
* Thu Sep 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-11
85582d6
- Allow users to exec restorecond
85582d6
f5a104d
* Tue Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-10
f5a104d
- Allow sendmail to request kernel modules load
f5a104d
4c2f298
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-9
405a74c
- Fix all kernel_request_load_module domains
405a74c
4c2f298
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-8
4c2f298
- Fix all kernel_request_load_module domains
405a74c
41f8e38
* Sun Sep 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-7
41f8e38
- Remove allow_exec* booleans for confined users.  Only available for unconfined_t
41f8e38
8323d54
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-6
8323d54
- More fixes for sandbox_web_t
8323d54
ab46291
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-5
ab46291
- Allow sshd to create .ssh directory and content
ab46291
d53d158
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-4
d53d158
- Fix request_module line to module_request
d53d158
1fb0a98
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-3
1fb0a98
- Fix sandbox policy to allow it to run under firefox.  
1fb0a98
- Dont audit leaks.
1fb0a98
1fb0a98
* Thu Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-2
9de7033
- Fixes for sandbox
9de7033
69290fd
* Wed Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-1
69290fd
- Update to upstream
69290fd
- Dontaudit nsplugin search /root
69290fd
- Dontaudit nsplugin sys_nice
69290fd
23e7082
* Mon Sep 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-5
23e7082
- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
23e7082
- Remove policycoreutils-python requirement except for minimum
23e7082
6b7b0c1
* Mon Sep 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-4
6b7b0c1
- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
6b7b0c1
- Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)
6b7b0c1
6b7b0c1
e20e351
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-3
e20e351
- Add wordpress/wp-content/uploads label
e20e351
- Fixes for sandbox when run from staff_t
e20e351
ddc8588
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-2
ddc8588
- Update to upstream
ddc8588
- Fixes for devicekit_disk
ddc8588
b8498d1
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-6
b8498d1
- More fixes
b8498d1
123ae99
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-5
123ae99
- Lots of fixes for initrc and other unconfined domains
123ae99
72bc25d
* Fri Sep 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-4
72bc25d
- Allow xserver to use  netlink_kobject_uevent_socket
72bc25d
72bc25d
* Thu Sep 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-3
72bc25d
- Fixes for sandbox 
72bc25d
1a2981b
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-2
1a2981b
- Dontaudit setroubleshootfix looking at /root directory
1a2981b
65c3f9a
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-1
65c3f9a
- Update to upsteam
65c3f9a
cb5670c
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-2
cb5670c
- Allow gssd to send signals to users
cb5670c
- Fix duplicate label for apache content
cb5670c
faf9cbb
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-1
faf9cbb
- Update to upstream
faf9cbb
38d427a
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-9
38d427a
- Remove polkit_auth on upgrades
38d427a
07c04f8
* Wed Aug 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-8
07c04f8
- Add back in unconfined.pp and unconfineduser.pp
42f9eff
- Add Sandbox unshare
07c04f8
89e3546
* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
89e3546
- Fixes for cdrecord, mdadm, and others
89e3546
080ce6f
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
080ce6f
- Add capability setting to dhcpc and gpm
080ce6f
8e64d7d
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-5
8e64d7d
- Allow cronjobs to read exim_spool_t
8e64d7d
c5f5b5d
* Fri Aug 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-4
c5f5b5d
- Add ABRT policy
c5f5b5d
e3dd491
* Thu Aug 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-3
e3dd491
- Fix system-config-services policy
e3dd491
fc8ff2f
* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
fc8ff2f
- Allow libvirt to change user componant of virt_domain
fc8ff2f
40243d9
* Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1
40243d9
- Allow cupsd_config_t to be started by dbus
40243d9
- Add smoltclient policy
40243d9
9c27022
* Fri Aug 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.27-1
9c27022
- Add policycoreutils-python to pre install
9c27022
b2c5e72
* Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-11
b2c5e72
- Make all unconfined_domains permissive so we can see what AVC's happen 
b2c5e72
7fe210d
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-10
7fe210d
- Add pt_chown policy
7fe210d
867473a
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-9
867473a
- Add kdump policy for Miroslav Grepl
867473a
- Turn off execstack boolean
867473a
ac7bbfa
* Fri Aug 7 2009 Bill Nottingham <notting@redhat.com> 3.6.26-8
ac7bbfa
- Turn on execstack on a temporary basis (#512845)
ac7bbfa
4de3826
* Thu Aug 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-7
4de3826
- Allow nsplugin to connecto the session bus
4de3826
- Allow samba_net to write to coolkey data
4de3826
e213303
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-6
e213303
- Allow devicekit_disk to list inotify
e213303
4816e90
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-5
4816e90
- Allow svirt images to create sock_file in svirt_var_run_t
4816e90
4673269
* Tue Aug 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-4
4673269
- Allow exim to getattr on mountpoints
4673269
- Fixes for pulseaudio
4673269
947b439
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-3
947b439
- Allow svirt_t to stream_connect to virtd_t
947b439
af4fa82
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-2
af4fa82
- Allod hald_dccm_t to create sock_files in /tmp
af4fa82
af4fa82
* Thu Jul 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-1
abd1536
- More fixes from upstream
abd1536
c6e2224
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.25-1
c6e2224
- Fix polkit label
c6e2224
- Remove hidebrokensymptoms for nss_ldap fix
c6e2224
- Add modemmanager policy
c6e2224
- Lots of merges from upstream
c6e2224
- Begin removing textrel_shlib_t labels, from fixed libraries
c6e2224
3750561
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.24-1
3750561
- Update to upstream
3750561
9160520
* Mon Jul 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-2
9160520
- Allow certmaster to override dac permissions
9160520
df7055d
* Thu Jul 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-1
df7055d
- Update to upstream
df7055d
df7055d
* Tue Jul 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-3
8da0248
- Fix context for VirtualBox
8da0248
2360ff9
* Tue Jul 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-1
2360ff9
- Update to upstream
2360ff9
2360ff9
* Fri Jul 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-4
2360ff9
- Allow clamscan read amavis spool files
2360ff9
a88b486
* Wed Jul 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-3
a88b486
- Fixes for xguest
a88b486
a85aeff
* Tue Jul  7 2009 Tom "spot" Callaway <tcallawa@redhat.com> 3.6.21-2
a85aeff
- fix multiple directory ownership of mandirs
a85aeff
d9676a6
* Wed Jul 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-1
d9676a6
- Update to upstream
d9676a6
bcc53da
* Tue Jun 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-2
bcc53da
- Add rules for rtkit-daemon
bcc53da
7b16d56
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-1
7b16d56
- Update to upstream
7b16d56
- Fix nlscd_stream_connect
7b16d56
221642f
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-5
221642f
- Add rtkit policy
221642f
d399fb4
* Wed Jun 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-4
d399fb4
- Allow rpcd_t to stream connect to rpcbind
d399fb4
9850f4d
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-3
9850f4d
- Allow kpropd to create tmp files
9850f4d
93dc66e
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-2
93dc66e
- Fix last duplicate /var/log/rpmpkgs
93dc66e
93dc66e
* Mon Jun 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-1
a9f0953
- Update to upstream
a9f0953
  * add sssd
a9f0953
8866315
* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.18-1
8866315
- Update to upstream
8866315
  * cleanup
6071093
* Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.17-1
6071093
- Update to upstream
6071093
- Additional mail ports
6071093
- Add virt_use_usb boolean for svirt
6071093
9386d6f
* Thu Jun 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-4
9386d6f
- Fix mcs rules to include chr_file and blk_file
9386d6f
e3bf679
* Tue Jun 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-3
e3bf679
- Add label for udev-acl
e3bf679
f8df9e5
* Mon Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-2
f8df9e5
- Additional rules for consolekit/udev, privoxy and various other fixes
f8df9e5
49883e8
* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-1
d3ae977
- New version for upstream
d3ae977
6b83805
* Thu Jun 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-3
6b83805
- Allow NetworkManager to read inotifyfs
6b83805
aa7b9cb
* Wed Jun 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-2
aa7b9cb
- Allow setroubleshoot to run mlocate
aa7b9cb
8197718
* Mon Jun 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-1
8197718
- Update to upstream 
8197718
8197718
* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-3
8197718
- Add fish as a shell
8197718
- Allow fprintd to list usbfs_t
8197718
- Allow consolekit to search mountpoints
8197718
- Add proper labeling for shorewall
8197718
9ee63df
* Tue May 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-2
9ee63df
- New log file for vmware
9ee63df
- Allow xdm to setattr on user_tmp_t
9ee63df
ef7416c
* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-1
ef7416c
- Upgrade to upstream
ef7416c
eead2a6
* Wed May 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-39
eead2a6
- Allow fprintd to access sys_ptrace
eead2a6
- Add sandbox policy
eead2a6
7b6c105
* Mon May 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-38
7b6c105
- Add varnishd policy
7b6c105
f72bd44
* Thu May 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-37
f72bd44
- Fixes for kpropd
f72bd44
fcb4418
* Tue May 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-36
fcb4418
- Allow brctl to r/w tun_tap_device_t
fcb4418
62cfafd
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-35
62cfafd
- Add /usr/share/selinux/packages
62cfafd
0f6b92d
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-34
0f6b92d
- Allow rpcd_t to send signals to kernel threads
0f6b92d
9924194
* Fri May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-33
9924194
- Fix upgrade for F10 to F11
9924194
a2098a5
* Thu May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-31
a2098a5
- Add policy for /var/lib/fprint
a2098a5
8a0604e
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-30
8a0604e
-Remove duplicate line
8a0604e
959ab94
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-29
959ab94
- Allow svirt to manage pci and other sysfs device data
959ab94
0e31a0e
* Mon May 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-28
0e31a0e
- Fix package selection handling
0e31a0e
5dd89f3
* Fri May 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-27
5dd89f3
- Fix /sbin/ip6tables-save context
c32d79e
- Allod udev to transition to mount
c32d79e
- Fix loading of mls policy file
5dd89f3
37ebfc9
* Thu Apr 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-26
37ebfc9
- Add shorewall policy
37ebfc9
37ebfc9
* Wed Apr 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-25
21b13fc
- Additional rules for fprintd and sssd
21b13fc
40d8f60
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-24
40d8f60
- Allow nsplugin to unix_read unix_write sem for unconfined_java
40d8f60
b3ac4a0
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-23
b3ac4a0
- Fix uml files to be owned by users
b3ac4a0
e080bbd
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-22
e080bbd
- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less
e080bbd
b11dbbb
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-21
e080bbd
- Allow confined users to manage virt_content_t, since this is home dir content
b11dbbb
- Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection
b11dbbb
b0991a2
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-20
b0991a2
- Fix labeling on /var/lib/misc/prelink*
b0991a2
- Allow xserver to rw_shm_perms with all x_clients
b0991a2
- Allow prelink to execute files in the users home directory
b0991a2
89c9c9a
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-19
dac8380
- Allow initrc_t to delete dev_null
dac8380
- Allow readahead to configure auditing
eaaf2ab
- Fix milter policy
eaaf2ab
- Add /var/lib/readahead
dac8380
cd0a396
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-16
cd0a396
- Update to latest milter code from Paul Howarth
cd0a396
5ce1c49
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-15
5ce1c49
- Additional perms for readahead
5ce1c49
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-14
4d5adb7
- Allow pulseaudio to acquire_svc on session bus
4d5adb7
- Fix readahead labeling
4d5adb7
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-13
4d5adb7
- Allow sysadm_t to run rpm directly
4d5adb7
- libvirt needs fowner
4d5adb7
3c498a7
* Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-12
3c498a7
- Allow sshd to read var_lib symlinks for freenx
3c498a7
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-11
a32a159
- Allow nsplugin unix_read and write on users shm and sem
a32a159
- Allow sysadm_t to execute su
a32a159
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-10
a32a159
- Dontaudit attempts to getattr user_tmpfs_t by lvm
a32a159
- Allow nfs to share removable media
a32a159
a32a159
* Mon Apr 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-9
a32a159
- Add ability to run postdrop from confined users
a32a159
d982e7e
* Sat Apr 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-8
d982e7e
- Fixes for podsleuth
d982e7e
d982e7e
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-7
d982e7e
- Turn off nsplugin transition
d982e7e
- Remove Konsole leaked file descriptors for release
dc00fc3
dc00fc3
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-6
6203f42
- Allow cupsd_t to create link files in print_spool_t
dc00fc3
- Fix iscsi_stream_connect typo
dc00fc3
- Fix labeling on /etc/acpi/actions
dc00fc3
- Don't reinstall unconfine and unconfineuser on upgrade if they are not installed
6203f42
4a0aac1
* Tue Apr 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-5
4a0aac1
- Allow audioentroy to read etc files
4a0aac1
685032c
* Mon Apr 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-4
685032c
- Add fail2ban_var_lib_t
685032c
- Fixes for devicekit_power_t
685032c
d4af172
* Thu Apr 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-3
d4af172
- Separate out the ucnonfined user from the unconfined.pp package
d4af172
90e4193
* Wed Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-2
90e4193
- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.
90e4193
25a4763
* Tue Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-1
25a4763
- Upgrade to latest upstream
25a4763
- Allow devicekit_disk sys_rawio
25a4763
510c2a3
* Mon Apr 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.11-1
510c2a3
- Dontaudit binds to ports < 1024 for named
510c2a3
- Upgrade to latest upstream
510c2a3
04b6828
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-9
04b6828
- Allow podsleuth to use tmpfs files
04b6828
80beeee
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-8
80beeee
- Add customizable_types for svirt
80beeee
f49c57d
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-7
f49c57d
- Allow setroubelshoot exec* privs to prevent crash from bad libraries
f49c57d
- add cpufreqselector
f49c57d
90ea5b3
* Thu Apr 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-6
90ea5b3
- Dontaudit listing of /root directory for cron system jobs
90ea5b3
3434a9b
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
3434a9b
- Fix missing ld.so.cache label
3434a9b
c0158a8
* Fri Mar 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-4
c0158a8
- Add label for ~/.forward and /root/.forward
c0158a8
6130d52
* Thu Mar 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-3
6130d52
- Fixes for svirt
6130d52
9ca87fc
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-2
9ca87fc
- Fixes to allow svirt read iso files in homedir
9ca87fc
5dce3c1
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-1
5dce3c1
- Add xenner and wine fixes from mgrepl
5dce3c1
bfc78b6
* Wed Mar 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-4
bfc78b6
- Allow mdadm to read/write mls override
bfc78b6
095146a
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
095146a
- Change to svirt to only access svirt_image_t
095146a
d4b8dcf
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
d4b8dcf
- Fix libvirt policy
d4b8dcf
b12011f
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-1
b12011f
- Upgrade to latest upstream
b12011f
c240b60
* Tue Mar 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-4
c240b60
- Fixes for iscsid and sssd
c240b60
- More cleanups for upgrade from F10 to Rawhide.
c240b60
e72f55a
* Mon Mar 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-3
e72f55a
- Add pulseaudio, sssd policy
e72f55a
- Allow networkmanager to exec udevadm
e72f55a
0c34c69
* Sat Mar 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-2
0c34c69
- Add pulseaudio context
0c34c69
a67a1c1
* Thu Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-1
a67a1c1
- Upgrade to latest patches
a67a1c1
0a03cce
* Wed Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-2
0a03cce
- Fixes for libvirt
0a03cce
8c3a31a
* Mon Mar 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-1
8c3a31a
- Update to Latest upstream
8c3a31a
8c3a31a
* Sat Feb 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-9
8c3a31a
- Fix setrans.conf to show SystemLow for s0
8c3a31a
4967525
* Fri Feb 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-8
4967525
- Further confinement of qemu images via svirt
4967525
150ff59
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.6.6-7
150ff59
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
150ff59
52cbcb4
* Thu Feb 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-6
52cbcb4
- Allow NetworkManager to manage /etc/NetworkManager/system-connections
52cbcb4
de67749
* Wed Feb 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-5
de67749
- add virtual_image_context and virtual_domain_context files
de67749
8f6e436
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-4
8f6e436
- Allow rpcd_t to send signal to mount_t
8f6e436
- Allow libvirtd to run ranged
8f6e436
8c2b68a
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-3
8c2b68a
- Fix sysnet/net_conf_t
8c2b68a
8179476
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-2
8179476
- Fix squidGuard labeling
8179476
2eec438
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-1
2eec438
- Re-add corenet_in_generic_if(unlabeled_t)
2eec438
e46e005
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-3
e46e005
1d1c058
* Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2
1d1c058
- Add git web policy
1d1c058
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-1
bd0db4f
- Add setrans contains from upstream 
bd0db4f
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-6
bd0db4f
- Do transitions outside of the booleans
bd0db4f
4ed140a
* Sun Feb 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-5
4ed140a
- Allow xdm to create user_tmp_t sockets for switch user to work
4ed140a
bc861e6
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-4
bc861e6
- Fix staff_t domain
bc861e6
73fe81b
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-3
73fe81b
- Grab remainder of network_peer_controls patch
73fe81b
659e96f
* Wed Feb 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-2
659e96f
- More fixes for devicekit
659e96f
c957c38
* Tue Feb 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-1
c957c38
- Upgrade to latest upstream 
c957c38
574cab4
* Mon Feb 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-13
574cab4
- Add boolean to disallow unconfined_t login
574cab4
0554a10
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-12
0554a10
- Add back transition from xguest to mozilla
0554a10
ab3e55d
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-11
ab3e55d
- Add virt_content_ro_t and labeling for isos directory
ab3e55d
f899107
* Tue Jan 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-10
f899107
- Fixes for wicd daemon
f899107
48adbea
* Mon Jan 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-9
48adbea
- More mls/rpm fixes 
48adbea
14c9b9c
* Fri Jan 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-8
14c9b9c
- Add policy to make dbus/nm-applet work
14c9b9c
40dd24d
* Thu Jan 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-7
40dd24d
- Remove polgen-ifgen from post and add trigger to policycoreutils-python
40dd24d
6f8856e
* Wed Jan 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-6
1b94a13
- Add wm policy
6cf32a1
- Make mls work in graphics mode
1b94a13
2a4bdae
* Tue Jan 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-3
2a4bdae
- Fixed for DeviceKit
2a4bdae
acc1376
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-2
acc1376
- Add devicekit policy
acc1376
1d72fb0
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-1
1d72fb0
- Update to upstream
1d72fb0
eacea1d
* Thu Jan 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-5
eacea1d
- Define openoffice as an x_domain
eacea1d
339bf3b
* Mon Jan 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-4
339bf3b
- Fixes for reading xserver_tmp_t
339bf3b
87fb153
* Thu Jan 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-3
87fb153
- Allow cups_pdf_t write to nfs_t
87fb153
2ed2ff4
* Tue Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-2
2ed2ff4
- Remove audio_entropy policy
2ed2ff4
292c49c
* Mon Jan 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-1
292c49c
- Update to upstream
292c49c
5df2628
* Sun Jan 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.1-15
5df2628
- Allow hal_acl_t to getattr/setattr fixed_disk
5df2628
3236390
* Sat Dec 27 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-14
3236390
- Change userdom_read_all_users_state to include reading symbolic links in /proc
3236390
cf8fd9f
* Mon Dec 22 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-13
cf8fd9f
- Fix dbus reading /proc information
cf8fd9f
bae2e98
* Thu Dec 18 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-12
bae2e98
- Add missing alias for home directory content
bae2e98
33c7eab
* Wed Dec 17 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-11
33c7eab
- Fixes for IBM java location
33c7eab
dcd0c96
* Thu Dec 11 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-10
dcd0c96
- Allow unconfined_r unconfined_java_t
dcd0c96
fd2b62e
* Tue Dec 9 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-9
fd2b62e
- Add cron_role back to user domains
fd2b62e
9a43d2b
* Mon Dec 8 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-8
9a43d2b
- Fix sudo setting of user keys
9a43d2b
2ae1615
* Thu Dec 4 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-7
01ce3df
- Allow iptables to talk to terminals
2ae1615
- Fixes for policy kit
2ae1615
- lots of fixes for booting. 
01ce3df
bcb1922
* Wed Dec 3 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-4
739db21
- Cleanup policy
739db21
23d6844
* Mon Dec 01 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 3.6.1-2
23d6844
- Rebuild for Python 2.6
23d6844
02d888c
* Fri Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-19
02d888c
- Fix labeling on /var/spool/rsyslog
02d888c
0d6e623
* Thu Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-18
0d6e623
- Allow postgresl to bind to udp nodes
0d6e623
2a650ea
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-17
2a650ea
- Allow lvm to dbus chat with hal
2a650ea
- Allow rlogind to read nfs_t 
2a650ea
074b12f
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-16
074b12f
- Fix cyphesis file context
074b12f
6a09cfb
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-15
6a09cfb
- Allow hal/pm-utils to look at /var/run/video.rom
6a09cfb
- Add ulogd policy
6a09cfb
411a424
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-14
411a424
- Additional fixes for cyphesis
411a424
- Fix certmaster file context
411a424
- Add policy for system-config-samba
6a09cfb
- Allow hal to read /var/run/video.rom
411a424
333ebd6
* Mon Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-13
333ebd6
- Allow dhcpc to restart ypbind
333ebd6
- Fixup labeling in /var/run
333ebd6
333ebd6
* Thu Oct 30 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-12
333ebd6
- Add certmaster policy
333ebd6
1bc89b8
* Wed Oct 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-11
2362056
- Fix confined users 
2362056
- Allow xguest to read/write xguest_dbusd_t
2362056
a3e038c
* Mon Oct 27 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-9
a3e038c
- Allow openoffice execstack/execmem privs
a3e038c
4fa9db7
* Fri Oct 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-8
4fa9db7
- Allow mozilla to run with unconfined_execmem_t
4fa9db7
798a73d
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-7
798a73d
- Dontaudit domains trying to write to .xsession-errors
798a73d
3281238
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-6
3281238
- Allow nsplugin to look at autofs_t directory
3281238
de61cc7
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-5
de61cc7
- Allow kerneloops to create tmp files
de61cc7
ae68d97
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-4
ae68d97
- More alias for fastcgi
ae68d97
236d3cc
* Tue Oct 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-3
236d3cc
- Remove mod_fcgid-selinux package
236d3cc
b9e15d9
* Mon Oct 20 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-2
b9e15d9
- Fix dovecot access
b9e15d9
49f48f4
* Fri Oct 17 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-1
49f48f4
- Policy cleanup 
49f48f4
6115689
* Thu Oct 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-3
6115689
- Remove Multiple spec
6115689
- Add include
6115689
- Fix makefile to not call per_role_expansion
6115689
4b4392d
* Wed Oct 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-2
4b4392d
- Fix labeling of libGL
4b4392d
b6cc6a8
* Fri Oct 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-1
b6cc6a8
- Update to upstream
b6cc6a8
675bbab
* Wed Oct 8 2008 Dan Walsh <dwalsh@redhat.com> 3.5.11-1
675bbab
- Update to upstream policy
675bbab
1062bd3
* Mon Oct 6 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-3
1062bd3
- Fixes for confined xwindows and xdm_t 
1062bd3
86369ef
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-2
86369ef
- Allow confined users and xdm to exec wm
86369ef
- Allow nsplugin to talk to fifo files on nfs
86369ef
f1a8278
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-1
f1a8278
- Allow NetworkManager to transition to avahi and iptables
b42a1ed
- Allow domains to search other domains keys, coverup kernel bug
b42a1ed
094ef3d
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-4
094ef3d
- Fix labeling for oracle 
094ef3d
2ede4ec
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-3
2ede4ec
- Allow nsplugin to comminicate with xdm_tmp_t sock_file
2ede4ec
9987374
* Mon Sep 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-2
9987374
- Change all user tmpfs_t files to be labeled user_tmpfs_t
9987374
- Allow radiusd to create sock_files
9987374
b709ffd
* Wed Sep 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-1
b709ffd
- Upgrade to upstream
b709ffd
ed32c64
* Tue Sep 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-7
ed32c64
- Allow confined users to login with dbus
ed32c64
d86efe5
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-6
d86efe5
- Fix transition to nsplugin
d86efe5
f0375d5
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-5
f0375d5
- Add file context for /dev/mspblk.*
f0375d5
f77dd2c
* Sun Sep 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-4
f77dd2c
- Fix transition to nsplugin
f77dd2c
'
11ef247
* Thu Sep 18 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-3
530772a
- Fix labeling on new pm*log
530772a
- Allow ssh to bind to all nodes
530772a
16c3ff1
* Thu Sep 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-1
16c3ff1
- Merge upstream changes
16c3ff1
- Add Xavier Toth patches
16c3ff1
16c3ff1
* Wed Sep 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-2
16c3ff1
- Add qemu_cache_t for /var/cache/libvirt
16c3ff1
aca77a6
* Fri Sep 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-1
aca77a6
- Remove gamin policy
aca77a6
d0d3073
* Thu Sep 4 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-2
d0d3073
- Add tinyxs-max file system support
d0d3073
0a219fe
* Wed Sep 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-1
0a219fe
- Update to upstream
487de6f
-       New handling of init scripts
0a219fe
0a219fe
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-4
0a219fe
- Allow pcsd to dbus
0a219fe
- Add memcache policy
0a219fe
3ad3552
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-3
3ad3552
- Allow audit dispatcher to kill his children
3ad3552
cd8bee5
* Tue Aug 26 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-2
cd8bee5
- Update to upstream
cd8bee5
- Fix crontab use by unconfined user
cd8bee5
eb7e6dc
* Tue Aug 12 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-2
eb7e6dc
- Allow ifconfig_t to read dhcpc_state_t
eb7e6dc
1a0f642
* Mon Aug 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-1
1a0f642
- Update to upstream
1a0f642
b5d09d1
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 3.5.3-1
b5d09d1
- Update to upstream 
b5d09d1
0f1bd62
* Wed Aug 2 2008 Dan Walsh <dwalsh@redhat.com> 3.5.2-2
0f1bd62
- Allow system-config-selinux to work with policykit
0f1bd62
170fa29
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-5
170fa29
- Fix novel labeling
170fa29
07bd5c4
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-4
07bd5c4
- Consolodate pyzor,spamassassin, razor into one security domain
07bd5c4
- Fix xdm requiring additional perms.
07bd5c4
8f2532e
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-3
8f2532e
- Fixes for logrotate, alsa
8f2532e
f12d5b9
* Thu Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-2
f12d5b9
- Eliminate vbetool duplicate entry
f12d5b9
feefeee
* Wed Jul 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-1
feefeee
- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
0b05335
- Change dhclient to be able to red networkmanager_var_run
feefeee
078ad09
* Tue Jul 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.0-1
6ed8533
- Update to latest refpolicy
078ad09
- Fix libsemanage initial install bug
6ed8533
6db69f0
* Wed Jul 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-14
6db69f0
- Add inotify support to nscd
6db69f0
43f9fce
* Tue Jul 8 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-13
43f9fce
- Allow unconfined_t to setfcap
43f9fce
273a44c
* Mon Jul 7 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-12
273a44c
- Allow amanda to read tape
273a44c
- Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
273a44c
- Add support for netware file systems
273a44c
258b00e
* Thu Jul 3 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-11
258b00e
- Allow ypbind apps to net_bind_service
258b00e
75edec4
* Wed Jul 2 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-10
75edec4
- Allow all system domains and application domains to append to any log file
75edec4
cd60b64
* Sun Jun 29 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-9
cd60b64
- Allow gdm to read rpm database
cd60b64
- Allow nsplugin to read mplayer config files
cd60b64
c186814
* Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8
c186814
- Allow vpnc to run ifconfig
c186814
f86ed5a
* Tue Jun 24 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-7
f86ed5a
- Allow confined users to use postgres
f86ed5a
- Allow system_mail_t to exec other mail clients
f86ed5a
- Label mogrel_rails as an apache server
f86ed5a
547aa2a
* Mon Jun 23 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-6
547aa2a
- Apply unconfined_execmem_exec_t to haskell programs
547aa2a
6959e0b
* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5
6959e0b
- Fix prelude file context
6959e0b
fe0d467
* Fri Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-4
fe0d467
- allow hplip to talk dbus
fe0d467
- Fix context on ~/.local dir
fe0d467
f4ff8bb
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-3
f4ff8bb
- Prevent applications from reading x_device
f4ff8bb
5608a9d
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-2
5608a9d
- Add /var/lib/selinux context
5608a9d
c5c253f
* Wed Jun 11 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-1
c5c253f
- Update to upstream 
c5c253f
f513c7b
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-5
15f71c5
- Add livecd policy
15f71c5
15f71c5
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-3
91ec07f
- Dontaudit search of admin_home for init_system_domain
91ec07f
- Rewrite of xace interfaces
91ec07f
- Lots of new fs_list_inotify
91ec07f
- Allow livecd to transition to setfiles_mac
91ec07f
80e0b80
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-2
80e0b80
- Begin XAce integration
80e0b80
4b7f030
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-1
4b7f030
- Merge Upstream
4b7f030
993c27d
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-48
993c27d
- Allow amanada to create data files
993c27d
993c27d
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-47
993c27d
- Fix initial install, semanage setup
993c27d
993c27d
* Tue May 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-46
993c27d
- Allow system_r for httpd_unconfined_script_t
993c27d
6c25b42
* Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45
6c25b42
- Remove dmesg boolean
6c25b42
- Allow user domains to read/write game data
6c25b42
86881dd
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-44
86881dd
- Change unconfined_t to transition to unconfined_mono_t when running mono
86881dd
- Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work
86881dd
2d8ff51
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-43
2d8ff51
- Remove old booleans from targeted-booleans.conf file
2d8ff51
2d8ff51
* Fri Apr 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-42
2d8ff51
- Add boolean to mmap_zero
2d8ff51
- allow tor setgid
2d8ff51
- Allow gnomeclock to set clock
2d8ff51
b4e9331
* Thu Apr 24 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-41
ef5e600
- Don't run crontab from unconfined_t
ef5e600
4b1d56d
* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39
4b1d56d
- Change etc files to config files to allow users to read them
4b1d56d
4b1d56d
* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37
4b1d56d
- Lots of fixes for confined domains on NFS_t homedir
4b1d56d
a6a82ae
* Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36
a6a82ae
- dontaudit mrtg reading /proc
a6a82ae
- Allow iscsi to signal itself
a6a82ae
- Allow gnomeclock sys_ptrace
bb36d75
06686c2
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-33
06686c2
- Allow dhcpd to read kernel network state
06686c2
41625a2
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-32
41625a2
- Label /var/run/gdm correctly
41625a2
- Fix unconfined_u user creation
41625a2
254e3c7
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-31
254e3c7
- Allow transition from initrc_t to getty_t
254e3c7
5a576e0
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-30
5a576e0
- Allow passwd to communicate with user sockets to change gnome-keyring
5a576e0
c3c4a52
* Sat Apr 5 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-29
7f851af
- Fix initial install
c3c4a52
27943de
* Fri Apr 4 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-28
27943de
- Allow radvd to use fifo_file
27943de
- dontaudit setfiles reading links
27943de
- allow semanage sys_resource
27943de
- add allow_httpd_mod_auth_ntlm_winbind boolean
27943de
- Allow privhome apps including dovecot read on nfs and cifs home 
27943de
dirs if the boolean is set
27943de
27943de
c66f2bc
* Tue Apr 1 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-27
c66f2bc
- Allow nsplugin to read /etc/mozpluggerrc, user_fonts
c66f2bc
- Allow syslog to manage innd logs.
c66f2bc
- Allow procmail to ioctl spamd_exec_t
c66f2bc
294ea7a
* Sat Mar 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-26
294ea7a
- Allow initrc_t to dbus chat with consolekit.
294ea7a
e54cb21
* Thu Mar 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-25
e54cb21
- Additional access for nsplugin
e54cb21
- Allow xdm setcap/getcap until pulseaudio is fixed
e54cb21
f70afcd
* Tue Mar 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-24
f70afcd
- Allow mount to mkdir on tmpfs
f70afcd
- Allow ifconfig to search debugfs
f70afcd
bf3d39e
* Fri Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-23
bf3d39e
- Fix file context for MATLAB
bf3d39e
- Fixes for xace
bf3d39e
94b7be9
* Tue Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-22
5ea3f10
- Allow stunnel to transition to inetd children domains
5ea3f10
- Make unconfined_dbusd_t an unconfined domain 
94b7be9
ba9e5e8
* Mon Mar 17 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-21
ba9e5e8
- Fixes for qemu/virtd
ba9e5e8
a6e1280
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-20
a6e1280
- Fix bug in mozilla policy to allow xguest transition
a6e1280
- This will fix the 
a6e1280
a6e1280
libsemanage.dbase_llist_query: could not find record value
a6e1280
libsemanage.dbase_llist_query: could not query record value (No such file or
a6e1280
directory)
a6e1280
 bug in xguest
a6e1280
d593d26
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-19
d593d26
- Allow nsplugin to run acroread
d593d26
987b10f
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-18
987b10f
- Add cups_pdf policy
987b10f
- Add openoffice policy to run in xguest
987b10f
7f811bf
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-17
7f811bf
- prewika needs to contact mysql
7f811bf
- Allow syslog to read system_map files
7f811bf
ceda8fe
* Wed Mar 12 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-16
ceda8fe
- Change init_t to an unconfined_domain
ceda8fe
0879f48
* Tue Mar 11 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-15
0879f48
- Allow init to transition to initrc_t on shell exec.
0879f48
- Fix init to be able to sendto init_t.
0879f48
- Allow syslog to connect to mysql
0879f48
- Allow lvm to manage its own fifo_files
0879f48
- Allow bugzilla to use ldap
0879f48
- More mls fixes 
0879f48
110bce3
* Tue Mar 11 2008 Bill Nottingham <notting@redhat.com> 3.3.1-14
110bce3
- fixes for init policy (#436988)
110bce3
- fix build
110bce3
2041ac3
* Mon Mar 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-13
2041ac3
- Additional changes for MLS policy
2041ac3
1bf67d5
* Thu Mar 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-12
1bf67d5
- Fix initrc_context generation for MLS
1bf67d5
dc57e68
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-11
dc57e68
- Fixes for libvirt
dc57e68
5947905
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-10
5947905
- Allow bitlebee to read locale_t
5947905
d8c1602
* Fri Feb 29 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-9
d8c1602
- More xselinux rules
d8c1602
9a0f35b
* Thu Feb 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-8
9a0f35b
- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t